<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>158699</bug_id>
          
          <creation_ts>2016-06-13 11:27:04 -0700</creation_ts>
          <short_desc>DFG Validation fails when performing a concatenation with only a single entry</short_desc>
          <delta_ts>2016-06-13 16:15:41 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Oliver Hunt">oliver</reporter>
          <assigned_to name="Saam Barati">saam</assigned_to>
          <cc>commit-queue</cc>
    
    <cc>fpizlo</cc>
    
    <cc>ggaren</cc>
    
    <cc>keith_miller</cc>
    
    <cc>mark.lam</cc>
    
    <cc>msaboff</cc>
    
    <cc>saam</cc>
    
    <cc>webkit-bug-importer</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1201885</commentid>
    <comment_count>0</comment_count>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2016-06-13 11:27:04 -0700</bug_when>
    <thetext>Fairly simple failure:

function f() {
    for (;;)`${1}`
}
f();

The issue is that we appear to be issuing a str_concat with a single child, which the DFG thinks is invalid. The obvious solutions are to either:
* don&apos;t emit str_concat from a single child template literal
* Have the DFG acknowledge this can happen

I think the former is the better option.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1201962</commentid>
    <comment_count>1</comment_count>
    <who name="Radar WebKit Bug Importer">webkit-bug-importer</who>
    <bug_when>2016-06-13 14:26:18 -0700</bug_when>
    <thetext>&lt;rdar://problem/26775638&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1201985</commentid>
    <comment_count>2</comment_count>
      <attachid>281211</attachid>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2016-06-13 15:35:57 -0700</bug_when>
    <thetext>Created attachment 281211
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1201986</commentid>
    <comment_count>3</comment_count>
      <attachid>281211</attachid>
    <who name="Saam Barati">saam</who>
    <bug_when>2016-06-13 15:38:39 -0700</bug_when>
    <thetext>Comment on attachment 281211
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=281211&amp;action=review

r=me

&gt; Source/JavaScriptCore/tests/stress/template-literal.js:209
&gt; +function testSingleNode() {

Can you also add other tests for valueOf, etc</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1201993</commentid>
    <comment_count>4</comment_count>
      <attachid>281211</attachid>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2016-06-13 15:51:22 -0700</bug_when>
    <thetext>Comment on attachment 281211
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=281211&amp;action=review

&gt;&gt; Source/JavaScriptCore/tests/stress/template-literal.js:209
&gt;&gt; +function testSingleNode() {
&gt; 
&gt; Can you also add other tests for valueOf, etc

Unrealted to this bug you mean? This bug is specifically because template literals would alway plant a strcat, even if there was only a single node.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1202001</commentid>
    <comment_count>5</comment_count>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2016-06-13 16:15:41 -0700</bug_when>
    <thetext>Committed r202015: &lt;http://trac.webkit.org/changeset/202015&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>281211</attachid>
            <date>2016-06-13 15:35:57 -0700</date>
            <delta_ts>2016-06-13 15:38:39 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-158699-20160613153732.patch</filename>
            <type>text/plain</type>
            <size>2449</size>
            <attacher name="Oliver Hunt">oliver</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMjAyMDAyCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw
dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCAy
ZDNlMzZjYzg0MTMyMTIzYTlhOGI1ZWYyMTVkZjRlYWI1NWU0OTJhLi41N2Y5N2UxN2M1OWNmMjNj
YmFjYTU0OWY0ZGY0Y2VlNzFmNjZkMGNhIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv
cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs
MyArMSwxOSBAQAorMjAxNi0wNi0xMyAgT2xpdmVyIEh1bnQgIDxvbGl2ZXJAYXBwbGUuY29tPgor
CisgICAgICAgIERGRyBWYWxpZGF0aW9uIGZhaWxzIHdoZW4gcGVyZm9ybWluZyBhIGNvbmNhdGVu
YXRpb24gd2l0aCBvbmx5IGEgc2luZ2xlIGVudHJ5CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr
aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTg2OTkKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP
RFkgKE9PUFMhKS4KKworICAgICAgICBGYWlybHkgc2ltcGxlIHNob3J0IGNpcmN1aXRpbmcgb2Yg
YSBzaW5nbGUgcmVwbGFjZW1lbnQgdGVtcGxhdGUgc3RyaW5nCisgICAgICAgIHdpdGhvdXQgYW55
IHBhZGRpbmcgdG8gYmUgcGxhbnRlZCBhcyBhIHNpbXBsZSB0byBzdHJpbmcgcmF0aGVyIHRoYW4K
KyAgICAgICAgb3Bfc3RyY2F0LgorCisgICAgICAgICogYnl0ZWNvbXBpbGVyL05vZGVzQ29kZWdl
bi5jcHA6CisgICAgICAgIChKU0M6OlRlbXBsYXRlTGl0ZXJhbE5vZGU6OmVtaXRCeXRlY29kZSk6
CisgICAgICAgICogdGVzdHMvc3RyZXNzL3RlbXBsYXRlLWxpdGVyYWwuanM6CisgICAgICAgICh0
ZXN0U2luZ2xlTm9kZSk6CisKIDIwMTYtMDYtMTMgIFl1c3VrZSBTdXp1a2kgIDx1dGF0YW5lLnRl
YUBnbWFpbC5jb20+CiAKICAgICAgICAgVW5yZXZpZXdlZCwgZm9sbG93IHVwIHBhdGNoIGZvciBy
MjAxOTY0CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvbXBpbGVyL05v
ZGVzQ29kZWdlbi5jcHAgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvbXBpbGVyL05vZGVz
Q29kZWdlbi5jcHAKaW5kZXggZGZiNDE2N2YxOGIzZTE0NzVhMjNlMjBlMWYxNGM1NWNhODA0MDNi
ZC4uNmI5YTI2ZGYxZjE5NGZhMjViNDFlYTNjMjMxZjIwZDAxZTk0YzVhYiAxMDA2NDQKLS0tIGEv
U291cmNlL0phdmFTY3JpcHRDb3JlL2J5dGVjb21waWxlci9Ob2Rlc0NvZGVnZW4uY3BwCisrKyBi
L1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9ieXRlY29tcGlsZXIvTm9kZXNDb2RlZ2VuLmNwcApAQCAt
MjcyLDYgKzI3Miw5IEBAIFJlZ2lzdGVySUQqIFRlbXBsYXRlTGl0ZXJhbE5vZGU6OmVtaXRCeXRl
Y29kZShCeXRlY29kZUdlbmVyYXRvciYgZ2VuZXJhdG9yLCBSZWdpCiAgICAgICAgIGdlbmVyYXRv
ci5lbWl0Tm9kZSh0ZW1wb3JhcnlSZWdpc3RlcnMubGFzdCgpLmdldCgpLCB0ZW1wbGF0ZVN0cmlu
Zy0+dmFsdWUoKSk7CiAgICAgfQogCisgICAgaWYgKHRlbXBvcmFyeVJlZ2lzdGVycy5zaXplKCkg
PT0gMSkKKyAgICAgICAgcmV0dXJuIGdlbmVyYXRvci5lbWl0VG9TdHJpbmcoZ2VuZXJhdG9yLmZp
bmFsRGVzdGluYXRpb24oZHN0LCB0ZW1wb3JhcnlSZWdpc3RlcnNbMF0uZ2V0KCkpLCB0ZW1wb3Jh
cnlSZWdpc3RlcnNbMF0uZ2V0KCkpOworCiAgICAgcmV0dXJuIGdlbmVyYXRvci5lbWl0U3RyY2F0
KGdlbmVyYXRvci5maW5hbERlc3RpbmF0aW9uKGRzdCwgdGVtcG9yYXJ5UmVnaXN0ZXJzWzBdLmdl
dCgpKSwgdGVtcG9yYXJ5UmVnaXN0ZXJzWzBdLmdldCgpLCB0ZW1wb3JhcnlSZWdpc3RlcnMuc2l6
ZSgpKTsKIH0KIApkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL3Rlc3RzL3N0cmVz
cy90ZW1wbGF0ZS1saXRlcmFsLmpzIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL3Rlc3RzL3N0cmVz
cy90ZW1wbGF0ZS1saXRlcmFsLmpzCmluZGV4IDI4YjQ0NzJjYTZhMzZhZTgzNTA0NzcxNWIwNGU1
YjU2OTFiYzE0N2MuLjY4YTZlZGM3ZDE3NjNlNDg4MTlhNTk0YTQ1ZTE5YWFlYWQ1Y2E2MDkgMTAw
NjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS90ZXN0cy9zdHJlc3MvdGVtcGxhdGUtbGl0
ZXJhbC5qcworKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvdGVzdHMvc3RyZXNzL3RlbXBsYXRl
LWxpdGVyYWwuanMKQEAgLTIwNSwzICsyMDUsMTEgQEAgdGVzdChgSGVsbG8gJHsgYENvJHtgY2B9
b2FgIH1gLCAiSGVsbG8gQ29jb2EiKTsKICAgICB0ZXN0KHN0YXRbMV0sIHVuZGVmaW5lZCk7CiAg
ICAgdGVzdChzdGF0WzJdLCB1bmRlZmluZWQpOwogfSgpKTsKKworZnVuY3Rpb24gdGVzdFNpbmds
ZU5vZGUoKSB7CisgICAgZm9yICh2YXIgaSA9IDA7IGkgPCAxMDAwOyBpKyspCisgICAgICAgIGAk
ezF9YAorfQorbm9JbmxpbmUodGVzdFNpbmdsZU5vZGUpCit0ZXN0U2luZ2xlTm9kZSgpOworCg==
</data>
<flag name="review"
          id="305066"
          type_id="1"
          status="+"
          setter="saam"
    />
          </attachment>
      

    </bug>

</bugzilla>